Spring Boot Lambda部署后MongoDB连接超时问题排查

问题描述 #

部署在AWS Lambda上的Spring Boot函数调用API时出现MongoDB连接超时错误，但本地运行完全正常，怀疑是AWS侧配置缺失导致。错误日志如下：

2022-12-31T01:42:59.669-06:00   07:42:59.669 INFO 8 --- [ main] org.mongodb.driver.cluster : No server chosen by com.mongodb.client.internal.MongoClientDelegate$1@515fff35 from cluster description ClusterDescription{type=REPLICA_SET, connectionMode=MULTIPLE, serverDescriptions=[ServerDescription{address=cluster0-shard-00-02.gu1ji.mongodb.net:27017, type=UNKNOWN, state=CONNECTING}, ServerDescription{address=cluster0-shard-00-01.gu1ji.mongodb.net:27017, type=UNKNOWN, state=CONNECTING}, ServerDescription{address=cluster0-shard-00-00.gu1ji.mongodb.net:27017, type=UNKNOWN, state=CONNECTING}]}. Waiting for 30000 ms before timing out

2022-12-31T01:43:07.405-06:00   07:43:07.405 INFO 8 --- [.net:27017] org.mongodb.driver.cluster : Exception in monitor thread while connecting to server cluster0-shard-00-02.gu1ji.mongodb.net:27017

2022-12-31T01:43:07.405-06:00   com.mongodb.MongoSocketOpenException: Exception opening socket

2022-12-31T01:43:07.405-06:00   at com.mongodb.internal.connection.SocketStream.open(SocketStream.java:70)

2022-12-31T01:43:07.405-06:00   at com.mongodb.internal.connection.InternalStreamConnection.open(InternalStreamConnection.java:180)

2022-12-31T01:43:07.405-06:00   at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.lookupServerDescription(DefaultServerMonitor.java:193)

2022-12-31T01:43:07.405-06:00   at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:157)

2022-12-31T01:43:07.405-06:00   at java.base/java.lang.Thread.run(Unknown Source)

2022-12-31T01:43:07.405-06:00   Caused by: java.net.SocketTimeoutException: connect timed out

2022-12-31T01:43:07.405-06:00   at java.base/java.net.PlainSocketImpl.socketConnect(Native Method)

2022-12-31T01:43:07.405-06:00   at java.base/java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)

2022-12-31T01:43:07.405-06:00   at java.base/java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)

2022-12-31T01:43:07.405-06:00   at java.base/java.net.AbstractPlainSocketImpl.connect(Unknown Source)

2022-12-31T01:43:07.405-06:00   at java.base/java.net.SocksSocketImpl.connect(Unknown Source)

2022-12-31T01:43:07.405-06:00   at java.base/java.net.Socket.connect(Unknown Source)

2022-12-31T01:43:07.405-06:00   at java.base/sun.security.ssl.SSLSocketImpl.connect(Unknown Source)

2022-12-31T01:43:07.405-06:00   at com.mongodb.internal.connection.SocketStreamHelper.initialize(SocketStreamHelper.java:107)

2022-12-31T01:43:07.405-06:00   at com.mongodb.internal.connection.SocketStream.initializeSocket(SocketStream.java:79)

2022-12-31T01:43:07.405-06:00   at com.mongodb.internal.connection.SocketStream.open(SocketStream.java:65)

2022-12-31T01:43:07.405-06:00   ... 4 common frames omitted

2022-12-31T01:43:07.405-06:00

07:43:07.405  INFO 8 --- [.net:27017] org.mongodb.driver.cluster               : Exception in monitor thread while connecting to server cluster0-shard-00-01.gu1ji.mongodb.net:27017
07:43:07.405 INFO 8 --- [.net:27017] org.mongodb.driver.cluster : Exception in monitor thread while connecting to server cluster0-shard-00-01.gu1ji.mongodb.net:27017

2022-12-31T01:43:07.405-06:00   com.mongodb.MongoSocketOpenException: Exception opening socket

解决方案 #

核心问题是Lambda环境无法建立到MongoDB Atlas的网络连接，以下是针对性排查步骤：

• 检查Lambda网络配置：

  • 如果Lambda部署在VPC内：确保VPC的安全组出站规则允许访问27017端口，同时VPC需配置NAT网关（私有子网）或互联网网关（公有子网），保证Lambda能访问公网；若使用VPC peering连接MongoDB Atlas，需确认peering连接已配置完成。
  • 如果Lambda未部署在VPC内：默认拥有公网访问权限，无需额外配置，但需确认MongoDB Atlas的白名单设置。

• 验证MongoDB Atlas白名单：

  • 若Lambda在VPC内：将VPC的NAT网关公网IP添加到MongoDB Atlas的IP白名单中。
  • 若Lambda不在VPC内：测试阶段可临时添加0.0.0.0/0到白名单（生产环境不建议），或配置AWS PrivateLink实现私有网络连接MongoDB Atlas。

• 确认MongoDB连接配置：

  • 检查Spring Boot的MongoDB连接URI是否正确，确保认证信息、副本集名称无误；Lambda环境下建议通过AWS Secrets Manager或Parameter Store存储连接信息，避免硬编码，同时确认Lambda执行角色有权限读取这些配置。
  • 在连接URI中增加超时参数，例如：mongodb+srv://<user>:<pass>@cluster0.gu1ji.mongodb.net/?connectTimeoutMS=30000&socketTimeoutMS=30000，延长超时时间避免连接过早断开。

• 检查IAM权限（若使用IAM认证）：

  • 若采用IAM认证方式连接MongoDB Atlas，需确保Lambda的执行角色拥有mongodb-atlas:connect相关权限，且已在MongoDB Atlas中配置对应的IAM用户。

内容的提问来源于stack exchange，提问作者Roshan Alwis